Undocumented Forge platform behaviour, measured and worked around.
A one-line import at the top of a resolver file makes the whole resolver stop existing, and forge lint reports no issues. That is the shape of most of what is collected here.
Egress rules the backend ignores and the client enforces. Display conditions reading app properties nobody documented. A key-value store where FAIL_IF_EXISTS gives you a real lock and a TTL lease quietly does not. Each piece names the behaviour, shows the smallest thing that reproduces it, and gives the workaround that held up in production. Where Atlassian has since documented something, that is said. Where it is still undocumented, you get how it was confirmed, so you can check it yourself.
What Jira workflow validators could not do, and what it took to put an LLM behind a transition without sending your data anywhere.
Notes from building a Microsoft-Project-style planner inside Jira Cloud, on Forge, against limits that are not negotiable.
Undocumented Atlassian Forge behaviour that passes lint, passes deploy, and breaks anyway.
The problems that only appear after deploy: testing against the live product, a security scan that passes wrongly, and rate limits counted in points.
Claude Sonnet 5.5 edged Claude Opus 5.5 on our general-programming benchmark, 0.7984 to 0.7926, a margin I read as level. On an Atlassian Forge app, Opus won 0.9767 to 0.5508. Every check behind both results, GPT-6.1 Sol and Sol Pro on the same two boards, how the benchmarks grade a running app, and the full bill for fine-tuning our own 27B model.
Confluence Cloud has no built-in way to lock attachments. This walks one file through Sentinel Vault 6.6.0 on a real site: seal it, overwrite it as someone else, watch the sealed version come back in seconds, read both versions in the history and over the REST API, then unlock it. Plus a bug in our own app that we hit while running it.
Jira Cloud's API rate limit is three limits at once, and Jira gives an admin no screen that says which app spends it. This walks the headers with curl, what a 429 tells you, and CogniRunner's Maintenance screen and REST report, hour by hour and by component.
A Forge app REST API is called from outside Jira with an OAuth 2.0 (3LO) access token. This walks the whole path with curl against LeanZero Management: the admin switch, the integration and its scopes, consent with sns, the token exchange, rotating refresh tokens, and the four 403s I hit on the way.
Sentinel Vault is one of the Runs on Atlassian apps that review Confluence content with AI. It calls Atlassian-hosted LLMs through the Forge LLMs API, so there is no API key to paste and no external data egress declared. What that buys an admin, who pays for the tokens, how the cost ceiling actually works, and the four places it is weaker than it looks.
CogniRunner lets a Jira admin put OpenAI, Anthropic, Gemini, Bedrock, a self-hosted model or the zero-key Atlassian Forge LLMs behind the same workflow validator. This walks the setup end to end and says what actually changes when you bring your own key: where the data goes, who pays, which models you get, and what Runs on Atlassian has to do with it.
When an admin adds a Forge app access rule to a data security policy, your app does not get an error that says so. It gets a 404 that looks like a missing issue and a search that comes back empty. I built a small probe app, blocked it on a test Jira site, and captured every status, every event payload and the one REST call that tells your app what happened.
Confluence does not fire a page delete event for a Forge app when a space or a parent page is deleted. Atlassian only emits a delete event for the top-level entity being deleted, by design, per their own documentation. Here's the exact rule, the one exception, and the REST-based workaround that actually keeps your app's storage in sync.
Call view.submit() in a jiraServiceManagement:portalRequestCreatePropertyPanel with the wrong payload shape and it compiles, resolves, and silently stores nothing. The shipped @forge/bridge types won't catch it. Here's the real shape, where it's documented, and how to read the value back.
You added emitsReadyEvent to a Confluence macro to speed up PDF export, called view.emitReadyEvent(), and every normal page view now logs "Unable to emit ready event." The shipped @forge/bridge source says why it happened, why it was harmless, and which version made it stop.
We're going to Atlassian Team '26 Europe in Amsterdam on 6-8 October, no sponsor booth, no speaking slot, just the two of us. Here's what we'd actually talk about: 60,000+ users migrated at a 100% delivery rate, six open-source migration toolkits anyone can take from GitHub, and thirteen published model weights on Hugging Face from training we've written up start to finish, adapters and all.
Qwen3.8-27B and Qwen3.5-9B were taught Forge, Jira and Confluence on a single Mac Studio with 96 GB. This is the whole procedure with the seven scripts that do it, printed in full: a pinned MLX environment with two patches, an 8-bit base with its speculative-decoding head kept as a sidecar, a chat-JSONL dataset built from a folder of Markdown, a segmented trainer with full-state checkpoints, an adapter expander, a per-module merge into the 8-bit shards. The kit was run end to end for this page on the 9B, in 21 minutes, and its real output follows each step, including the one where the validation loss turns the wrong way.
Three days after v0.3, the Qwen3.8-27B we teach Forge went from 12 of 25 compiling apps to 21 of 25. On the way our own release rule rejected it, correctly by its own text, over a 40-character window repeated 13 times at 32k context. The window was a line of box-drawing characters in an ASCII diagram. Here is what changed, what the metric got wrong, and what we changed so it cannot happen the same way again.
Qwen3.8-27B knows almost nothing about Atlassian Forge: ask it for an app and it invents a manifest format and imports packages that do not exist. Over four days on one Mac Studio I trained it until 14 of 25 manifests passed Atlassian's own validator and 12 of 25 apps compiled, from zero. The weights are public. Here is what it is, what it is not, and why I think it is a first.
The types ship, your resolver cannot see them, and on a Forge app this is not an editor annoyance — the bundler type-checks, so it fails the build. Three TypeScript majors give three different errors, and only one setting is safe.
Cloud Fortified monitoring is bound to app versions, not to your framework. Publish a Forge version and the probes keep hitting your old Connect base URL — each one carrying its own 99.9% SLO, and redirects are not followed.
A buffer task that absorbs slip until it can't, a plan that defends itself against edits made in Jira, and a write path that refuses rather than lies. Traced line by line, and set against what BigPicture and Structure.Gantt actually document.
Two triggers fired on the release that took us to 4.0.0, not one. I wrote a tool that knew about six of them when the docs list eleven, published a thesis that inverted the truth, and found the correct answer sitting in a comment in the same commit.
The @forge/api route template throws on two different mistakes with one identical message. Six steps to tell them apart and fix each, with a probe that prints exactly which characters it rejects in a path and which it silently encodes in a query.
A Forge resolver that takes a page id from the payload and writes with asApp() will write to any page the caller can name. Six steps to gate it, with a test suite that fails 5 of 6 before the fix and passes 6 of 6 after.
Forge delivered one page edit twice, 400ms apart. The duplicate didn't post a second comment — it wiped the 24-hour window that stops second comments. Then I wrote the whole thing up backwards, and the test I built to prove it agreed with me.
The removed Jira search endpoint fails loudly with a 410. The one-line migration to /search/jql fails quietly: HTTP 200, the right number of issues, and every field null. Measured from inside a deployed Forge app.
For a year our workflow conditions evaluated a constant and gated nothing. 3.1.0 replaces that constant with ten checks that Jira runs itself. Here is what shipped, what I measured against a live Jira, and how it compares to what else is on the Marketplace.
Forge gives you no veto over a Confluence save. Product events arrive after the change is already committed, which means a lock on Confluence content cannot prevent anything — it can only detect and restore. Here is what that constraint does to an app: why the restore has to ignore itself, why reverting the whole page is the wrong fix, and why a licence check in a protection app must fail open.
A 5,300-issue plan put 94,920 nodes in the DOM. Windowing the rows took it to 2,115 — and left a second full-height layer that windowing does not touch.
Forge does have an atomic create-if-absent, and it holds under concurrency. Add a TTL to turn it into a lease and it stops being one. Measured on a deployed app, with the manifest and code for the pattern that actually holds.
forge deploy now blocks on lint errors, so the scope linter has quietly become a gate. It only reads endpoints written inline — one request helper hides every call in your codebase. Measured on @forge/cli 13.4.0, including what the runtime actually returns when a scope is missing.
A Forge PPM app needs a live in-browser scheduler and a server-side one. They drift by a day, no test goes red, and the user believes the preview. Here is the harness that catches it — and the two mutations I ran to prove it works.
We shipped both modules in CogniRunner pointing at the same handler. Only one of them ever invoked it. forge lint says No issues found, forge deploy validates the manifest and passes, and the gate you built is permanently open with zero log lines. Here is the probe app that proves it, and the two things that actually work.
A blocks link in Jira records a relationship. On Free and Standard it reschedules nothing. Here's the engine we put behind it, the required-start rule that's easy to get subtly wrong, and what it still can't do.
Since March 2, 2026, a Forge app shares one 65,000-point hourly pool across every install. Ours spent it by 18 minutes past the hour. Here's the metering, the count tripwires and the self-imposed budget that took a 13,500-user Confluence estate down to ~2,000 points in a quiet hour — without a bigger quota.
Atlassian gave Forge developers 55 days to move off jira:fullPage and confluence:fullPage. I built the cross-product app that fails today, reproduced the lint error verbatim, then migrated it to global:fullPage and deployed it into Jira and Confluence on one installation — and found that the context no longer tells you which product you are in.
The same URL in two Forge permission lists means two different things. I read the shipped matcher, deployed a probe to a live site, and measured which half of the docs is wrong.
One unused frontend import in a shared file takes a Forge function from HTTP 200 to HTTP 424. It throws at import time, the stack trace blames the wrong function, forge lint says No issues found, and the error message changed in April so the threads you'll find on Google no longer match.
Connect had entity_property_contains_any_user_group. Forge has no such named condition — but it can do the same job with a jiraExpression over your app's own properties. Here is the working manifest, the endpoint that actually exists, and the one-character bug that hides your module everywhere.
Running SAST and SCA on a Forge app is easy. The hard part is that your scanner and the reviewer's will disagree about the same version, and if you don't explain why first, your report loses.
Your Forge app's unit tests pass and it still breaks inside Jira. Here's how I drive a deployed Custom UI app in a real browser with Playwright — past the iframe and past Atlassian's 2FA.
CogniRunner's latest update brings local AI inference, a zero-key Atlassian-hosted model, and declarative AI actions that write back to Jira — all configured in plain English.
A practical, end-to-end guide to wiring large language models into Jira workflows with Atlassian Forge — using CogniRunner as the real-world case study.
Every workflow validator on the Atlassian Marketplace requires scripting. Every AI app for Jira is an assistant that can’t block a transition. CogniRunner sits in the gap between those two worlds — plain-English prompts that evaluate Jira field content, including attachments, as a real-time workflow gate.
Confluence supports dark mode. Your Forge app should too. This tutorial covers the full theme implementation for a production Custom UI app -- from Forge Bridge detection to a comprehensive CSS variable system that switches automatically.